[Pkg-graphite-maint] Bug#744708: [graphite-web] [DFSG] Missing sources

[bastien ROUCARIES]

Package: graphite-web
Severity: serious
Version: 0.9.12+debian-3
user: debian-qa at lists.debian.org
usertags: source-is-missing
severity: serious
X-Debbugs-CC: ftpmaster at debian.org

Hi,

Your package seems to include some files that lack sources
in prefered forms of modification:


webapp/content/js/ace/ace.js
webapp/content/js/ace/keybinding-vim.js
webapp/content/js/ace/mode-c_cpp.js
webapp/content/js/ace/mode-clojure.js
webapp/content/js/ace/mode-coffee.js
webapp/content/js/ace/mode-csharp.js
webapp/content/js/ace/mode-css.js
webapp/content/js/ace/mode-groovy.js
webapp/content/js/ace/mode-html.js
webapp/content/js/ace/mode-java.js
webapp/content/js/ace/mode-javascript.js
webapp/content/js/ace/mode-json.js
webapp/content/js/ace/theme-textmate.js
webapp/content/js/ace/worker-javascript.js
webapp/content/js/ext/ext-all.js
webapp/content/js/ext/pkgs/cmp-foundation.js
webapp/content/js/ext/pkgs/data-foundation.js
webapp/content/js/ext/pkgs/data-grouping.js
webapp/content/js/ext/pkgs/data-json.js
webapp/content/js/ext/pkgs/data-list-views.js
webapp/content/js/ext/pkgs/data-xml.js
webapp/content/js/ext/pkgs/direct.js
webapp/content/js/ext/pkgs/ext-core.js
webapp/content/js/ext/pkgs/ext-dd.js
webapp/content/js/ext/pkgs/ext-foundation.js
webapp/content/js/ext/pkgs/pkg-buttons.js
webapp/content/js/ext/pkgs/pkg-charts.js
webapp/content/js/ext/pkgs/pkg-forms.js
webapp/content/js/ext/pkgs/pkg-grid-editor.js
webapp/content/js/ext/pkgs/pkg-grid-foundation.js
webapp/content/js/ext/pkgs/pkg-grid-grouping.js
webapp/content/js/ext/pkgs/pkg-grid-property.js
webapp/content/js/ext/pkgs/pkg-history.js
webapp/content/js/ext/pkgs/pkg-menu.js
webapp/content/js/ext/pkgs/pkg-tabs.js
webapp/content/js/ext/pkgs/pkg-tips.js
webapp/content/js/ext/pkgs/pkg-toolbars.js
webapp/content/js/ext/pkgs/pkg-tree.js
webapp/content/js/ext/pkgs/resizable.js
webapp/content/js/ext/pkgs/state.js
webapp/content/js/ext/pkgs/window.js
webapp/content/js/ext/adapter/ext/ext-base.js
webapp/content/js/ext/adapter/jquery/ext-jquery-adapter.js
webapp/content/js/ext/adapter/prototype/ext-prototype-adapter.js
webapp/content/js/ext/adapter/yui/ext-yui-adapter.js

According to Debian Free Software Guidelines [1] (DFSG) #2:
 "The program must include source code, and must allow distribution 
  in source code as well as compiled form.".

This could also constitute a license violation for some copyleft licenses such as the GNU GPL.

In order to solve this problem, you could:
1. repack the origin tarball adding the missing source to it.
2  add the source files to "debian/missing-sources" directory

Both way satisfies the requirement that we ship the source. Second option
might be preferable due to the following reasons [2]:
 - Upstream can do it too and you could even supply a patch to them, thus full filling our social contract [3], see particularly §2.
 - If source and non-source are in different locations, ftpmasters may
   miss the source and (needlessly) reject the package.
 - The source isn't duplicated in every .diff.gz/.debian.tar.* (though
   this only really matters for larger sources).

You could also ask debian-qa at lists.debian.org or #debian-qa for more
guidance.

[1] https://www.debian.org/social_contract.en.html#guidelines
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736873#8
[3] https://www.debian.org/social_contract